Under Australia’s Strategy for Protecting Crowded Places from Terrorism, owners and operators carry the primary responsibility for protecting their own sites, including a duty of care to take reasonable steps against foreseeable threats.
This responsibility applies across Australia and to a wide range of locations where large numbers of people gather, including shopping centres, sporting venues, transport environments, hospitality venues, civic spaces and other crowded places.
For boards, asset managers, venue operators and councils deciding how to approach protective security, understanding what the strategy expects from owners and operators is more useful than focusing on any single security measure.
Who Counts as an Owner or Operator
The Strategy applies broadly to the people and organisations responsible for crowded places. This includes businesses, major event organisers, sporting clubs, charities, community groups, religious organisations, and local, state, territory, and Commonwealth governments.
A crowded place is not defined only by its size or by whether it is busy at all times. The Australian Government notes that crowded places can include locations such as shopping centres, pubs, clubs, places of worship, tourist attractions, transport infrastructure and civic spaces, and that crowd numbers can vary by time of day, season or event.
This means responsibility can sit with different parties depending on who owns, manages or operates the site and the activities taking place there.
What Primary Responsibility Actually Requires
The Strategy places responsibility on owners and operators to understand what the current terrorist threat environment means for their site and to put suitable security plans and measures in place.
It identifies risk assessment and vulnerability analysis as key parts of this process, alongside implementing appropriate mitigations, monitoring their effectiveness, and reviewing them when circumstances change.
Owners and operators may need to:
- Understand the factors that could make their site an attractive target
- Undertake a formal security risk assessment or vulnerability analysis where appropriate
- Develop and maintain suitable security and emergency arrangements
- Implement proportionate protective security measures
- Audit existing security measures to identify gaps
- Exercise and review security plans
- Engage with state or territory police where appropriate
- Ensure staff understand relevant security procedures and reporting arrangements
Responsibility That Cannot Be Handed to a Contractor
Engaging a security provider does not remove the owner’s or operator’s underlying responsibility for managing security risks.
The Australian Government’s Security Contracts Guiding Principles are designed to help owners and operators understand how security contracts fit within their broader protective security responsibilities. A contractor can provide specialist services, but the owner or operator must still understand the risks affecting the site, determine what protection is appropriate, and oversee the arrangements in place.
At governance level, this distinction is critical. A security contract should form part of the organisation’s wider risk management framework, rather than being treated as a substitute for one.
Local Government’s Dual Role as Owner and Approver
Local government carries a distinct version of this responsibility. Where a council owns or manages civic spaces, public activities, or community events, the Strategy treats it as both owner and operator, with the same duty of care as any other. This includes developing, implementing, and regularly testing its own protective security measures.
Councils also carry a second, separate role as the authority approving public space design, which is a genuine opportunity to build protective security into a precinct or public space early, when it is far cheaper and less disruptive than retrofitting it later. This is where a council’s Development Control Plan and the design decisions it sets for a precinct start to intersect with the owner and operator obligations covered here.
Where Proportionate Design Fits
Protective security should be proportionate to the risks affecting the site and should, where possible, preserve the public’s use and enjoyment of the place. The Strategy recognises that protective security can be implemented through a combination of measures rather than relying on a single physical intervention.
The physical environment can form part of this approach. Sightlines, landscaping, lighting, access arrangements, building layout, and other design considerations influence how people move through and use a crowded place.
This is where Crime Prevention Through Environmental Design can support broader protective security planning. CPTED addresses how the built environment can influence opportunities for crime and perceptions of safety, while a broader security risk assessment considers the wider range of threats and protective measures relevant to the site.
The two approaches can therefore complement each other without being treated as the same assessment.
Choosing a Security Consultant Under the Strategy
Because the strategy expects owners and operators to seek specialist advice rather than make these calls alone, it also sets out what to look for in a consultant. The listed considerations include current security licensing, qualifications, skills and experience, previous experience conducting security reviews, subject matter knowledge, professional associations and impartiality of advice, meaning the consultant has no commercial affiliation that could bias a recommendation toward a particular product or provider.
These criteria matter because a documented risk assessment or crowded places assessment demonstrates that an owner or operator has met their responsibility to understand the site’s risk, rather than simply asserting it.
Assess Your Crowded Place Security Risks
CPTED Australia prepares crowded places assessments and security risk assessments to help owners and operators understand the risks affecting their sites and identify proportionate protective measures.
The assessment can consider the site’s physical environment, operational characteristics, relevant threats, and existing security arrangements, providing a documented basis for decisions by owners, operators, and other project stakeholders.
If you need to assess the security risks affecting a crowded place, contact CPTED Australia or call (02) 9191 9771 to discuss the appropriate assessment for your site.
About the Author
Simon Pollak is the Principal Consultant at CPTED Australia. He is a Fellow of the Australian Security Industry Association (FASIAL), a Certified Information Systems Security Professional (CISSP), holds a Master of Cyber Security, and is a licensed security consultant. His practice covers CPTED assessments, security risk assessments and security strategy for developments and venues across Australia.